CVE-2024-25739

What it actually does

Missing bounds check on ubi->leb_size in create_empty_lvol allows a zero-byte memory allocation attempt that triggers a kernel crash (denial of service).

Why it matters to the business

Local users or processes on affected Linux systems can cause kernel panics, leading to system reboots, service interruptions, and potential data loss in environments relying on UBI/MTD storage.

How an attack unfolds

An attacker with local access crafts input that reaches create_empty_lvol without a positive leb_size value; the kernel attempts the invalid allocation and crashes. No remote or unauthenticated path exists.

How to fix it

Apply the upstream fix commit 68a24aba7c593eafa8fd00f2f76407b9b32b47a9 or upgrade to a Linux kernel version containing this commit. Rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 68a24aba7c593eafa8fd00f2f76407b9b32b47a9, then exercise UBI volume creation paths and confirm no crash occurs on zero-size attempts.

Typical attack path

1. Obtain local shell or code execution on target Linux system
2. Trigger code path that calls create_empty_lvol with ubi->leb_size set to zero
3. Observe kernel panic and system reboot

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for panic or oops entries near calls to create_empty_lvol or drivers/mtd/ubi/vtbl.c; correlate with UBI volume operations.

• kernel panic.*create_empty_lvol
• drivers/mtd/ubi/vtbl.c
• attempt to allocate zero bytes

What your security team should do

• Prioritize patching systems that expose UBI/MTD interfaces to untrusted local users
• Monitor for kernel oops/panic reports referencing vtbl.c or create_empty_lvol
• Restrict local access where possible until patches are applied